nullfs: panic: vrele: negative ref cnt

Hi,
here is part of textdump:

db:1:lockinfo> show locks
db:1:locks>  show alllocks
Process 722 (sh) thread 0xc4134000 (100065)
db:1:alllocks>  show lockedvnods
Locked vnodes
db:0:kdb.enter.panic>  show pcpu
cpuid        = 1
curthread    = 0xc4134000: pid 722 "sh"
curpcb       = 0xc3ba8d90
fpcurthread  = 0xc4134000: pid 722 "sh"
idlethread   = 0xc3d08d80: pid 10 "idle: cpu1"
APIC ID      = 1
currentldt   = 0x50
spin locks held:
db:0:kdb.enter.panic>  bt
Tracing pid 722 tid 100065 td 0xc4134000
kdb_enter(c0610bfe,c0610bfe,c061db9e,c3ba8aa8,1,...) at kdb_enter+0x3a
panic(c061db9e,0,c061cee6,88e,4,...) at panic+0x136
vrele(c4326d9c,0,c433fb5f,82,c060f3c7,...) at vrele+0x111
null_nodeget(c3fd4780,c4326d9c,c3ba8bf4,0,c3ba8be4,...) at null_nodeget+0xa0
null_bypass(c3ba8be0,c3f35a78,c3ba8c28) at null_bypass+0x141
VOP_VPTOCNP_APV(c4340240,c3ba8be0,c061bf01,387,c3cecc00,...) at
VOP_VPTOCNP_APV+0xb3
vn_vptocnp(c3ba8c4c,c061bf01,3af,c3ba8c3c,c3f35a78,...) at vn_vptocnp+0xd9
vn_fullpath1(c3cecc00,c3ba8c5c,3fc,315,c3cecc00,...) at vn_fullpath1+0x29a
kern___getcwd(c4134000,bfbfe884,0,400,c3ba8d2c,...) at kern___getcwd+0xd0
__getcwd(c4134000,c3ba8cf8,8,c0617c09,c0640290,...) at __getcwd+0x29
syscall(c3ba8d38) at syscall+0x261
Xint0x80_syscall() at Xint0x80_syscall+0x20
--- syscall (326, FreeBSD ELF32, __getcwd), eip = 0x2814edfb, esp =
0xbfbfe6cc, ebp = 0xbfbfe788 ---


panic: vrele: negative ref cnt
cpuid = 1
KDB: enter: panic
shared lockmgr ufs (ufs) r = 0 (0xc43c36a0) locked _at_
/usr/src/sys/kern/vfs_default.c:790
shared lockmgr ufs (ufs) r = 0 (0xc43c36a0) locked _at_
/usr/src/sys/kern/vfs_default.c:790

0xc43c3648: tag ufs, type VDIR
    usecount 1, writecount 0, refcount 1 mountedhere 0
    flags ()
    lock type ufs: SHARED (count 1)
        ino 3583142, on dev ad0s1h

0xc43c3430: tag null, type VDIR
    usecount 4, writecount 0, refcount 5 mountedhere 0
    flags ()
    lock type ufs: SHARED (count 1)
        vp=0xc43c3430, lowervp=0xc43c3648


How to reproduce it:

# mount_nullfs /usr/local/src /usr/src
# cd /sys
# whereis something


It appears panic have been introduced after r189488

-- 
Paul